lib/dnssec/ta kr_ta_covers_qry(): generalize and improve

The closer (N)TA will win now.  That wasn't the case
if we had a positive TA underneath a negative TA.
(Well, I can't recall ever seeing anything close to a use case.)